safety investigation report - mtip.gov.mt repository/msiu documents... · out the periodical survey...

MV Hellenic Sea 201204/018 1

Marine Safety Investigation Unit

MV Hellenic Sea

SAFETY INVESTIGATION REPORT

201204/018 REPORT NO.: 07/2013 April 2013

MV Hellenic Sea Serious injuries to five crew members

following a boiler explosion

In the port of Inchon

26 April 2012

SUMMARY

The vessel arrived alongside at

Incheon on 24 April 2012. Cargo

discharge operations commenced

at 0840 on the same day.

At the request of the managers, a

surveyor from the vessel‟s

classification society attended on

board on 25 April in order to carry

out the periodical survey on the

auxiliary oil fired and exhaust gas

boilers.

Following the survey, the class

surveyor issued a list of pending

items to be completed by 27 April

2012. These included the

adjustment of the safety valves to

an opening pressure of 7.5 bar.

The repairs were completed on 26

April and the boiler started.

At approximately 2025, when the

steam drum pressure on the

pressure gauge was reported to

read approximately 1.60 bar, the

boiler steam drum collapsed.

The escaping drum contents

seriously injured some of the

engine-room personnel, who

were testing the boiler.

The safety investigation

concluded that although the

safety valves opened at 7.2 bar,

the engine-room personnel

testing the boiler tightened them

further, wrongly basing their

decision on the readings of the

pressure gauge.

MSIU has issued one

recommendation to the mangers,

aimed to address risk assessment.

The Merchant Shipping (Accident and Incident Safety Investigation) Regulations, 2011 prescribe that the sole objective of marine safety investigations carried out in accordance with the regulations, including analysis, conclusions, and recommendations, which either result from them or are part of the process thereof, shall be the prevention of future marine accidents and incidents through the ascertainment of causes, contributing factors and circumstances.

Moreover, it is not the purpose of marine safety investigations carried out in accordance with these regulations to apportion blame or determine civil and criminal liabilities. NOTE

This report is not written with litigation in mind and pursuant to Regulation 13(7) of the Merchant Shipping (Accident and Incident Safety Investigation) Regulations, 2011, shall be inadmissible in any judicial proceedings whose purpose or one of whose purposes is to attribute or apportion liability or blame, unless, under prescribed conditions, a Court determines otherwise.

The report may therefore be misleading if used for purposes other than the promulgation of safety lessons.

© Copyright TM, 2013

This document/publication (excluding the logos) may be re-used free of charge in any format or medium for education purposes. It may be only re-used accurately and not in a misleading context. The material must be acknowledged as TM copyright. The document/publication shall be cited and properly referenced. Where the MSIU would have identified any third party copyright, permission must be obtained from the copyright holders concerned.


FACTUAL INFORMATION

Vessel

Hellenic Sea is a bulk carrier built in 1991 at

Jiangnan Shipyard, Shanghai, China. The ship

has an overall length of

225.00 m, a beam of 32.20 m, and a depth of

18.00 m. Her deadweight of

65,433.70 mt corresponded to a summer draft

of about 13.13 m.

Propulsive power is provided by one HD

MAN B&W 5L70MCE low speed diesel

engine, delivering 9451 kW at 100 rpm. Low

pressure steam is supplied by an oil-fired

boiler type Gadelius / Sunrod CPDB-15 and an

exhaust gas boiler type Aalborg AQ-2. The

vessel had a valid UMS notification

At the time of the accident, Hellenic Sea was

registered in Malta and classed with Bureau

Veritas1. It was owned by Patmos Shipping

Co. Ltd., operated by Mantinia Shipping Co.

Ltd., and managed by Hellenic Ship

Management Corporation.

The Injured Crew

The ship had a crew of 27, comprising 26

Filipino and the master of Greek nationality.

All the crew members were appropriately

qualified to hold their positions on board. The

vessel‟s manning was in accordance with the

Minimum Safe Manning Certificate.

The chief engineer had joined the vessel at

Port Said, Egypt on 23 February 2012. He had

been at sea for about 10 years and had served

as a chief engineer for just over four years. He

had already served for six months as a chief

engineer on another vessel under the

management of the company.

The second engineer had joined the vessel in

Singapore on 14 April 2012. He had been at

sea for about 15 years and had served as a

second engineer for about 5.5 years. This was

1 On owners‟ request, the vessel‟s Registry was closed

on 23 August 2012 in terms of

Article 28(1) of the Merchant Shipping Act.

the second engineer‟s first contract on a vessel

under the management of the company.

The third engineer had joined the vessel in

Jeddah, Saudi Arabia on 07 February 2012.

He had been at sea for about 13 years and had

served as a third engineer for about 7.5 years.

This was not the first contract for the third

engineer on a vessel under the management of

the company, having also served for about 19

months in this rank with them.

The fourth engineer had joined the vessel in

Singapore together with the second engineer.

He had been at sea for about 9 years and had

served as a fourth engineer for about 2.5 years.

This was the second engineer‟s first contract

with the company.

The oiler had joined the vessel in Singapore

with the second and fourth engineers. He had

been at sea for about 12 years in this rank.

This was not the first contract for the oiler

with other vessels under the same

management, as he had already served on

vessels under the same management for about

14 months.

The Auxiliary Oil-fired Boiler

Small in size and light in weight, the boiler is

designed to be suitable for use as a marine

boiler.

The Sunrod boiler (Figure 1) has pin tubes

with extended heating surfaces and is

considered as a hybrid between fire tube

boilers and water tube boilers.


Figure 1: Sunrod boiler Adopted from: www.aalborgindutries.com

The vertical welded cylindrical body consists

of a furnace and a convection part integrated

with the drum. The furnace consists of a gas

tight membrane wall from which the flue gases

pass through the pin tube elements to the

smoke-box on the top of the boiler. A number

of downcomer tubes connecting the drum to

the ring header ensure a good natural

circulation at all loads through the furnace

tubes (Figure 2).

The boiler is side-fired, which makes the

boiler very easy to ventilate and gives an

operation and maintenance friendly location of

the burner and its controls. The incoming

system water is mixed into the boiler drum by

means of a spreader with nozzles. The hot

water generation is practically instant. The

response from load variation is very fast.

Figure 2: Water and steam flow diagram

The boiler can be inspected on the water side

through the manhole in the pressure vessel and

through the hand holes in the ring header. On

the gas side, the boiler can be inspected from

the flue gas box at the top of the boiler and

from the furnace.

Calibration of Engine-room’s Pressure and

Temperature Gauges

The verification of boiler pressure gauges was

mandatory. It is a class requirement that in

those circumstances where the calibration of

the gauge could not be readily verified, a

written statement had to be obtained from the

master/chief engineer, confirming that the

gauges had been calibrated. Another option

was to have a second gauge for the verification

of the primary gauge.

Documentary evidence indicated that the

vessel‟s pressure and temperature gauges had

last been calibrated (by a pressure gauge

calibration instrument available on board) on

19 March 2012, i.e. about five weeks prior to

the accident happened. This was within the

time frame stipulated in the company‟s safety

management procedures. Spare gauges were


also available on board. The calibration of the

instruments was included in Chapter VII –

Maintenance Manual, Chapter 02, Procedure 4

of the Company‟s safety management system

manual.

Environment

The wind was calm and the sea state was calm

glassy inside the port area. The light intensity

in the engine-room was adequate and not

considered to be contributory to the accident.

NARRATIVE2

Hellenic Sea departed from the port of

Yuzhny, Ukraine on 23 March 2012 at 0400

bound for Incheon, Republic of Korea,

carrying corn in bulk. The vessel arrived at

Incheon on 22 April at 2200 and berthed

alongside berth no. 51 on 24 April. Until then,

the voyage was uneventful. Cargo discharge

operations commenced at 0840 on the same

day.

At the request of the managers, a surveyor

from the vessel‟s classification society

attended on board on 25 April in order to carry

out the periodical survey on the auxiliary oil-

fired and exhaust gas boilers. The periodic

survey was due on 05 May 2012.

As part of the survey, the safety valves on the

oil-fired boiler were tested in the presence of

the attending class surveyor and both were

reported to have opened at 7.2 bar. Following

the survey, the class surveyor issued a list of

pending items to be rectified by 27 April 2012.

The pending items included (but were not

limited to) the rectification of water leaks on

the water level gauge, leaks on various valves

and piping and the adjustment of the safety

valves to an opening pressure of 7.5 bar.

2 Unless otherwise stated time is local (LT).

The repairs on the boiler were carried out by

the third engineer, who was in charge of the

boiler operation and related maintenance. The

third engineer was assisted by the second

engineer. The repairs were completed on 26

April at approximately 2015.

The oil-fired boiler was prepared for start-up

as soon as the repairs were completed. The

chief engineer, second, third and fourth

engineers were monitoring the process. One

of the oilers was also in close proximity,

cleaning in way of the boiler furnace. The

steam pressure on the boiler pressure gauge

prior to the starting was reported to be about

1.3 bar.

The third engineer carried out an initial

ignition test on the boiler burner unit under

manual control and subsequently started the

boiler on the automatic control mode. The

third engineer reported that the burner starting

sequence, including the purging of the boiler

furnace, was completed without any problems.

He also reported that the burner flame was

checked repeatedly through the sight glass and

no abnormalities were observed.

The boiler mountings and piping, which had

just been repaired, were also inspected for any

visible leaks. No leaks were reported.

Tightening of the safety valves was apparently

carried by the engine-room personnel during

the verification of the auxiliary boiler‟s

operation.

At approximately 2025, when the steam drum

pressure was reported to be 1.60 bar, the boiler

steam drum collapsed, releasing its contents in

the surrounding area within the engine-room

and seriously injuring all the engine-room

personnel around the boiler. The third

engineer managed to leave the site and raise

the initial alarm.

The master instructed the chief mate and other

crew members to administer first aid treatment

to the injured crew members and secure the

area. At the same time, the third mate


contacted the local authorities and reported the

accident.

At 2050, an ambulance arrived and transferred

the second, third and fourth engineers and the

oiler to the local hospital. In the meantime,

the master inspected the engine-room and

verified that the affected area was secured

from potential fire and pollution threats.

It was concluded that the engine-room could

be safely accessed. In view of the number of

injured crew members, the electrician and

remaining engine-room crew members

assumed the responsibility for the engine-room

watches.

At 2115, the chief engineer was also landed

ashore and transferred to the hospital to

receive treatment for minor injuries. He

returned on board on 28 April. The second,

third and fourth engineers remained in hospital

to receive treatment for burn injuries.

Boiler Damage

The boiler (Figure 3) sustained considerable

damage.

Figure 3: Boiler condition after the accident

An inspection of the boiler revealed that the

boiler furnace top plating had collapsed into

the furnace. The damage was attributed to an

overpressure condition inside the steam drum

(Figure 4).

Figure 4: Boiler furnace roof after it collapsed into

the furnace as a result of an overpressure condition

The steam generating tubes (Figures 5 and 6),

furnace supports, and burner guide ring

(Figures 7) had also sustained severe damage.

Figure 5: Steam generating tubes and partly

detached furnace roof

Figure 6: Damaged steam generating tube detail


Figure 7: Damaged burner guide ring

As a result of the explosion, the burner

assembly was found about 20 m away from the

boiler (Figure 8).

Figure 8: Damaged burner assembly

A section of the exhaust uptake and expansion

bellows mounted between the flue gas box and

exhaust ducting had been dislodged, damaging

a nearby steel ladder (Figures 9 and 10).

Figure 9: Damaged exhaust uptake and expansion

bellows

Figure 10: Damaged ladder

ANALYSIS

Aim

The purpose of a marine safety investigation is

to determine the circumstances and safety

factors of the accident as a basis for making

recommendations, to prevent further marine

casualties or incidents from occurring in the

future.

The Source of the Boiler Damage

On the basis of the available evidence, the

safety investigation excluded the possibility of

an explosion inside the furnace. The boiler

was started in accordance with the

manufacturer‟s instructions and established

safety management system procedures.


The chief and third engineers reported that the

boiler start sequence, including the purging of

the furnace, was carried out without any

issues. The flame was also monitored and

observed to be healthy whilst the burner was in

operation. It was therefore evident that the

occurrence had initiated from the water side.

De-activated Defences

During the examination of the damaged boiler,

it was noticed that a steam valve, designated

OV15, and mounted on top of the boiler, was

found closed (Figure 11). The steam valve in

question supplied steam to the boiler pressure

gauge.

Furthermore, valve OV15 supplied steam both

to the pressure transmitter which controlled the

starting and stopping of the burner unit, and to

pressure switches, which activate the high and

low pressure alarms and the high pressure

boiler shutdown.

Figure 11: Part of the water feed and steam system

showing steam valve OV 15

The steam valve was closed prior to the

commencement of the repairs on the boiler on

26 April. Following the completion of the

repairs and prior to the boiler start-up, the

engine-room personnel did not open the steam

valve OV15.

When the boiler was started on 26 April at

about 2025, the boiler pressure gauge was

showing the residual pressure in the length of

pipe between the closed steam valve and the

pressure gauge. The actual pressure in the

boiler after the start-up was higher than that

shown on the pressure gauge. The pressure

transmitter and pressure switches, isolated

from the actual conditions inside the steam

drum, failed to stop the burner and activate

both the alarms and other fitted safety

defences.

Testing of the Safety Valves

It was established that following the survey,

the engineers had adjusted the safety valves

with the intention to test their opening

pressure.

The engineers started the boiler with no

indication of the working pressure (given that

the pressure gauge was isolated from the

system). Unaware of this, when the safety

valves opened they concluded that the opening

pressure was about 1.60 bar, which was the

pressure reading on the pressure gauge. In

fact, the valves had operated at a pressure of

7.2 bar (which was the opening pressure

recorded in the presence of the class surveyor

on the previous day).

It was evident that the engine-room personnel

perceived that the opening pressure of the

safety valves was set far too low and therefore

their intention was to rectify the situation by

tightening the safety valves even further.

Evidence suggested that this procedure was

repetitive, given that each time the safety

valves opened, the pressure on the gauge read

1.60 bar.

The boiler burner continued to supply

uninterrupted heat until the boiler working

pressure of 8.0 bar was exceeded. As a result

of the excessive tightening, the safety valves


failed to open and eventually the pressure

inside the boiler exceeded the design pressure,

resulting in the implosion of the furnace and

the release of the boiler contents and steam

into the engine-room.

The tightening procedure did not reflect

industry established procedures. It is the norm

that safety valves of oil-fired and exhaust gas

boilers are adjusted in the presence of a

classification society surveyor. Moreover, the

set pressure should not exceed the working

pressure of the boiler3.

It is also the norm that in the case where there

are two safety valves fitted, one of the safety

valves is to be gagged (by means of a gag),

whilst the other safety valve is tested. On

completion, the procedure is then reversed so

that in turn, all valves would have been tested.

There is no evidence to show that this was the

procedure followed on board.

Safety Management System and Risk

Assessment

Boiler maintenance and inspection was

addressed in Volume VII, Chapter 1 of the

company‟s safety management system

(SMS)4. The SMS manual made reference to

periodic inspections of the boiler‟s fire and

water sides to ensure that they were

maintained clean and free from corrosion, and

ensuring that the intactness of the brickwork

and the tightness of the boiler casings was

maintained.

Reference was made to specific parts of the

boiler, including the brickwork, boiler furnace

and gas spaces, external fittings and the super

heaters. Whilst there was no cross-reference

to any specific guidelines or procedures on

3 It is not being stated in any way that the engine-

room personnel were negligent. The status of the

system was such that that it did not allow the engine-

room personnel to deduce its actual status. This will

be further discussed in the following sections of the

safety investigation report.

4 Procedure 08.7: E/R Equipment Maintenance

Guidelines.

how these periodical inspections had to be

carried out, the procedure made no reference

to the testing procedure of the boiler‟s safety

valves.

Despite the SMS in place (one of its scopes is

to avoid accidents similar to this one), the risks

materialised into an accident. It is the view of

the MSIU that the problem was not at policy

level but at the middle level of the system.

The middle level of the SMS is the level where

general safety policy objectives are translated

into maintenance concepts, planning and

procedures to achieve improved safety. The

translation process is the responsibility of the

senior management. The lack of operational

procedures (including a detailed risk

assessment) for the testing and adjustment of

the safety valves was indicative of a problem

in the translation process.

The accident dynamics suggested that the

policy level was not represented by the

operational realisation of the system. Safety

management relates to the actual practices

(associated with remaining safe) and this is

where a formal procedure was missing and not

highlighting potential job safety related issues.

In this particular case, i.e. work on the boiler

safety valves, a specific company procedure

was lacking, and when the operations did not

follow the rules of logic and unforeseen risk

materialised, the crew members became

unsafely exposed to the residual hazards of the

system.

Risk Assessment and Situation Awareness

A Risk Assessment Analysis Form was filled

in before the repair job was initiated. The

Analysis Form only made reference to the

sight glass. The existing control measures

seemed very shallow, i.e. not addressing the

details of the task. For instance, one of the

identified control measures was “before

performing the job, discuss the potential

hazard.” However, there was no reference as


to the actual potential hazards identified during

the pre-job discussion.

The Form also required the inclusion of a

detailed hypothetical scenario as part of the

hazard/incident identification (related to the

task to be performed). Even in this area, it did

not transpire that the hazards were correctly

identified – the only entry (hazard scenario)

being “personnel injury and fire.”

The aim of a risk assessment exercise is to

qualify whether or not the status of any system

is acceptable and to help determine what

changes are necessary to make it acceptable.

Such an exercise would have not only

provided an estimate of the size of risk, but it

should have also enabled a comparison of the

risk level with some given criteria and serve as

a platform for a professional judgement to be

made in determining what system

improvements are needed to increase safety.

Maintenance activities cause deviations during

normal operations. Thus, whilst maintenance

increases component reliability and safety,

accidents often occur during maintenance.

From the perspective of situation awareness,

risk assessment is crucial. Risk assessment is

a process (which depends on, inter alia,

perception), that will generate a person‟s

knowledge of the system or situation

awareness even during maintenance activities.

The link between risk assessment and situation

awareness is that the former is vital to pave the

way for a compatible representation of people

and systems i.e. a stage when the awareness of

system status in the minds of the crew

members becomes a true reflection of the

actual and real status of the system.

Incompatible representations (either on the

crew member‟s side or the boiler‟s status)

would definitely mean potential problems. On

board Hellenic Sea, the information exchanges

were hampered by the closed valve (which

compromised the operation of the safety

defences, the boiler itself, and the crew

members‟ potential to understand the system

status) and a shallow risk assessment –

severely compromising the information flow

between system components that included the

crew members.

What actually happened prior and during the

unfolding of the events was that the crew

members were neither able to comprehend the

system status nor project an accurate future

status. This phenomenon was so crucial that

the crew members did not perceive any

problem (or suspected anything) when several

minutes had elapsed and the steam pressure on

the gauge had remained almost constant at

about 1.6 bar.

Memory and Situation Awareness

A (memory) failure to carry out a necessary

check can be caused by some local distraction.

Distractions may lead to „premature exits‟ i.e.

a job is terminated before all the actions are

complete – especially if it is the end of a

routine task.

It is expected that tasks on board may be

subject to frequent interruptions, and the work

on the boiler was not an exception.

Irrespective of their nature, all interruptions

may raise stress levels and increase the

likelihood of memory lapse – omission being

the most likely one.

The ability to maintain information in the

working memory is particularly important,

especially when engaged in safety critical

tasks5. For instance, working memory is

utilised when going through a series of steps

within a process.

If someone is distracted or interrupted while

focussing attention to hold this information,

they would probably forget steps s/he may

have completed. Literature suggests that any

information contained in the distraction phase,

erases the material that the working memory

store would have been holding.

5 Double checking the status of all the valves before

start-up is a safety issue where memory would have

been critical.


Attention is a cognitive system that has a

limited capacity and depends on, inter alia,

memory. Thus, attention and working

memory are closely tied together. It is for this

particular reason that workload is considered

to be very important to attention and working

memory.

Whilst sequencing tasks (even by the use of

checklists or a list of items whose status had

been altered before the initiation of the

maintenance task), is an effective way to

address workload, interruptions may be

problematic – especially when these lead to

the loss of memory contents. This may create

a situation where system status is

(inadvertently) not reinstated.

It is not excluded that the time window during

which the maintenance was carried out and the

unavailability of a checklist / memo had

contributed to the missing of the last stages of

the task i.e. the reinstatement of the system

defences prior to the start-up of the boiler.

CONCLUSIONS

1. The pressure inside the steam drum

exceeded the design pressure, resulting

in the implosion of the furnace and the

release of boiler contents and steam into

the engine-room.

2. The injuries sustained by the crew

members were a result of the collapse of

the oil-fired boiler steam drum following

a pressure build-up, which exceeded the

design pressure.

3. During the examination of the damaged

boiler, it was noticed that a steam valve,

designated OV15, and mounted on top of

the boiler, was found closed. This status

had effectively de-activated all the

boiler‟s safety defences.

4. The engineers altered the oil-fired boiler

safety valves settings by adopting a

procedure which did not reflect the

industry‟s norm.

5. The safety valves were tightened

excessively and consequently failed to

open to relieve the pressure.

6. The SMS manual lacked an operational

procedure (including a detailed risk

assessment) for the testing and

adjustment of the boiler safety valves.

7. As a result of the shallow risk

assessment made on board, the crew

members were neither able to

comprehend the system status nor

accurately project its future status.

8. It is not excluded that the crew members

had a memory lapse as a result of which,

the system status was not reinstated, and

the steam valve remained closed.

SAFETY ACTIONS TAKEN DURING

THE COURSE OF THE SAFETY

INVESTIGATION6

The company has taken the following safety

actions:

1. A Safety Office Meeting was held with

the participation of the Managing

Director, Fleet Divisions Manager, DPA

and all Department Managers in order to

discuss and assess the accident, identify

the root causes and contributing factors,

and decide upon the corrective and

preventive actions.

2. The Company advised the boiler

manufacturer of the company‟s findings

in order to share the lesson learned.

3. A Safety Alert has been forwarded to all

managed vessels describing the accident

and requesting all chief engineers to

thoroughly inspect and ensure the proper

operation of the auxiliary and the

exhaust gas boilers, and report back to

the Company. It was also requested that

the Safety Alert is discussed during the

on board safety meetings and relevant

6 Safety actions and recommendations should not

create a presumption of blame and/or liability.


crew members revert with suggestions

regarding additional preventive controls.

4. A full review of the Company‟s PMS

and checklists related to boiler and

associates, had been conducted. A note

was inserted in the PMS highlighting

that before starting the boiler, the

shipboard personnel should ensure that

the operation is conducted according to

manufacturer‟s instructions.

5. A risk assessment has been conducted

with the hypothetical scenario of the

boiler‟s failure in auto and manual

modes.

6. The company‟s auditors and

superintendents were instructed to place

special/particular attention during their

regular visits on board to all tests /

checks conducted prior to auxiliary

boilers‟ operation.

7. The company contacted the boiler‟s

maker in order to establish additional

ways / means for the early identification

of any malfunction of the auxiliary

boiler.

8. Although hours of work and sleep were

not identified as a contributing factor to

this accident, software licenses were

purchased for all ships to monitor the

crew members‟ hours of work and rest

more effectively.

RECOMMENDATIONS

Hellenic Ship Management Corp. is

recommended to:

07/2013_R1 Adopt a training programme for

relevant crew members in order to provide

the necessary tools and skills to

objectively identify hazards and

understand risk and its assessment.


SHIP PARTICULARS

Vessel Name: Hellenic Sea

Flag: Malta

Classification Society: Bureau Veritas

IMO Number: 8905828

Type: Bulk Carrier

Registered Owner: Patmos Shipping Co. Ltd.

Managers: Hellenic Shipmanagement Corp.

Construction: Steel

Length Overall: 225.0 m

Registered Length: 215.65 m

Gross Tonnage: 36448

Minimum Safe Manning: 16

Authorised Cargo: Solid Cargo in Bulk

VOYAGE PARTICULARS

Port of Departure: Yuzhny, Ukraine

Port of Arrival: Incheon, Republic of Korea

Type of Voyage: International

Cargo Information: Corn in bulk

Manning: 23

MARINE OCCURRENCE INFORMATION

Date and Time: 26 April 2012 at 20:25 (LT)

Classification of Occurrence: Serious Marine Casualty

Location of occurrence: Port of Incheon

Place on board Engine-room

Injuries / fatalities: Five crew members injured

Damage/environmental impact: Extensive damage to the boiler and minor damage to the engine-room

Ship Operation: Normal Service – Alongside/Moored

Voyage Segment: Alongside

External & Internal Environment: Calm wind and calm glassy sea. Artificial lighting in the engine-room.

Persons on board: 27

safety investigation report - mtip.gov.mt repository/msiu documents... · out the periodical survey...

Documents